luckberg/familysync
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(12): WR-03 document and log single-write process.env semantics in oidcFallback

Browse Source 
The oidcConfigFallbackMiddleware permanently mutates process.env on first
request then never re-reads from DB. Log an explicit info message when each
value is written so operators can see when a restart is required to pick up
config changes, and add inline documentation of the single-write semantics
to prevent silent misconfiguration after a re-run of the wizard.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Lucas Berger
2026-06-15 16:17:41 -04:00
co-authored by Claude Sonnet 4.6
parent a4e0ea4f14
commit 7a512a9726
1 changed files with 20 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/api/src/auth/middleware.ts
+20 -5
View File
@@ -80,11 +80,26 @@ export async function oidcConfigFallbackMiddleware(c: Context, next: Next): Prom
.limit(1); .limit(1);
if (row?.value) { if (row?.value) {
// Inject into process.env so oidcAuthMiddleware()'s env(c) picks it up // Inject into process.env so oidcAuthMiddleware()'s env(c) picks it up.
// This is safe: these are non-secret, app-config-owned values (D-01) // This is safe: these are non-secret, app-config-owned values (D-01).
if (key === 'oidc_issuer') process.env.OIDC_ISSUER = row.value; //
if (key === 'oidc_client_id') process.env.OIDC_CLIENT_ID = row.value; // WR-03 — single-write semantics: once written, process.env is NOT re-read
if (key === 'app_external_url') process.env.OIDC_AUTH_EXTERNAL_URL = row.value; // from DB on subsequent requests (the needsXxx guard above is false once set).
// Consequence: if the operator changes these values via the wizard after the
// container is already running, the in-process value is stale until restart.
// A container restart is required to pick up any changed OIDC config values.
if (key === 'oidc_issuer') {
console.info('[oidcFallback] Writing OIDC_ISSUER from app_config — container restart required to update this value');
process.env.OIDC_ISSUER = row.value;
}
if (key === 'oidc_client_id') {
console.info('[oidcFallback] Writing OIDC_CLIENT_ID from app_config — container restart required to update this value');
process.env.OIDC_CLIENT_ID = row.value;
}
if (key === 'app_external_url') {
console.info('[oidcFallback] Writing OIDC_AUTH_EXTERNAL_URL from app_config — container restart required to update this value');
process.env.OIDC_AUTH_EXTERNAL_URL = row.value;
}
} }
} }
} }